{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-16T13:36:43.315Z",
  "record_id": "VXI-EXT-PROCUREMENT-NPM-EXPLICIT-SCRIPTS-01-v1",
  "record_kind": "external_reference",
  "title": "npm ignore-scripts: Explicit commands still execute",
  "system": "npm CLI",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does ignore-scripts make every npm operation safe from project script execution?",
  "near_questions": [
    "Does npm test still run with ignore-scripts?",
    "Does npm run execute its requested script?",
    "Are pre- and post-scripts skipped?",
    "Is the flag an execution sandbox?",
    "Which npm version is installed?",
    "Was the setting effective during installation?",
    "Can a later command execute project code?",
    "What script body will be invoked?",
    "Is the repository trusted for execution?",
    "Does installation success establish safe script behaviour?",
    "Which authority covers the next agent command?",
    "Can I save the install-versus-execute boundary?"
  ],
  "supported_claims": [
    {
      "claim": "In npm CLI v11, ignore-scripts suppresses package.json scripts during operations such as installation. Commands explicitly intended to run a script, including npm test and npm run, still run the requested script while omitting pre- and post-scripts. This setting is not an execution sandbox for later agent commands.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "In npm CLI v11, ignore-scripts suppresses package.json scripts during operations such as installation. Commands explicitly intended to run a script, including npm test and npm run, still run the requested script while omitting pre- and post-scripts. This setting is not an execution sandbox for later agent commands.",
  "related_record_ids": [],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "npm install ignore-scripts",
    "source_url": "https://docs.npmjs.com/cli/v11/commands/npm-install/",
    "checked_on": "2026-10-16",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-NPM-EXPLICIT-SCRIPTS-01-v1",
    "candidate_record_sha256": "4181dc0b4d980998293c9a953ae84c42579254df0664f959aab9881fba83a809",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "In npm CLI v11, ignore-scripts suppresses package.json scripts during operations such as installation. Commands explicitly intended to run a script, including npm test and npm run, still run the requested script while omitting pre- and post-scripts. This setting is not an execution sandbox for later agent commands.",
    "required_buyer_context": "npm CLI version, effective setting, exact command and project script authority. Effective configuration and dated operational evidence have not been inspected.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-16",
    "claim_to_check": "Once ignore-scripts is set, no npm command can run project code.",
    "documented_statement": {
      "status": "documented",
      "statement": "In npm CLI v11, ignore-scripts suppresses package.json scripts during operations such as installation. Commands explicitly intended to run a script, including npm test and npm run, still run the requested script while omitting pre- and post-scripts. This setting is not an execution sandbox for later agent commands.",
      "source_ids": [
        "npm"
      ]
    },
    "buyer_evidence_required": [
      "npm version and effective configuration.",
      "Exact proposed command and requested script.",
      "Project trust and execution environment."
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Require separate execution authority for explicit scripts even when installation scripts are disabled."
    },
    "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.",
    "evidence_sources": [
      {
        "source_id": "npm",
        "url": "https://docs.npmjs.com/cli/v11/commands/npm-install/",
        "final_url": "https://docs.npmjs.com/cli/v11/commands/npm-install/",
        "title": "npm install ignore-scripts",
        "checked_on": "2026-10-16",
        "sha256": "b92c48db4f936d35d93e47edc69d830192e11a7d1499666c02d7913079e15dc1",
        "bytes": 717826
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.",
    "paid_value": {
      "decision_context": "Preserve the execution boundary used when approving a coding-agent workflow.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "npm CLI version, effective setting, exact command and project script authority."
    }
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#npm-ignore-scripts-explicit-command-boundary",
  "machine_readable_record": "/varexis-index/records/npm-ignore-scripts-explicit-command-boundary.json"
}